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ARP Message Format 
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HAW" Address Type 


Protocol Addres s Type 


HAW Adr Len II Prot Adr Len 


1 Operation 


Sender's h/w address (6 bytes) 




Sender s Prot Address (4 bytes) ! 
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Target h/w address (6 bytes) 
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Target Protocol Address (4 bytes) 
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Firewall 



Anti-Spoofing State 
Machine 



Address Resolution 
Cache (Shadow Copy) 
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OS 
TCP/IP 



Address Resolution 

Module 
Address Resolution 

Cache ^1° 



Host Computer Station 

~ r 



70^ 



Spoofer's 
Computer Station 



Target Computer 
Station 



Receive A Message Submitting An Unsolicited Address 
Resolution For A Network Protocol Address 





r 


Check Local Cache Of Address Resolution Information ' 
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For A Cache Hit Having A Different Address Resolution For the 
Network Protocol Address, Request Network Entities To Report 
Address Resolution For Network Protocol Address 
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If No Reply Messages Include The Previously Cached Address 
Resolution, Update the Cache With The Submitted Address 

Resolution 


\ 
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If A Reply Message Includes The Previously Cached Address 
Resolution, Maintain The Previously Cached Address Resolution 
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Computer Host 

Other Computer Subject To Target Computer 

Stations Potential Spoofing Station 

Attack 





Unsolicited Message With 
Genuine Address Resolution 
For Network Protocol Address 

Of Target 6"* 


Broadcast Request Message 
For Address Resolution Of 
Network Protocol Address Of 
Target 




Broadcast Request Message 
For Address Resolution Of 
Network Protocol Address Of 
Target 


* ( — 
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Reply Message With Genuine 
Address Resolution For Network 
Protocol Address Of Target 







Spoofer 



Computer Host 
Subject To 
Potential Spoofing 
Attack 



Target Computer 
Station 



Unsolicited Message With 
Spoofed Address Resolution 
For Network Protocol Address 
Of Target ~}c?!> 



Broadcast Request Message 
For Address Resolution Of 
Network Protocol Address Of 
Target 




Reply Message With Spoofed 

Address Resolution For 
Network Protocol Address Of 
Target 



Broadcast Request Message 
For Address Resolution Of 
Network Protocol Address Of 
Target 



Reply Message With Genuine 
Address Resolution For Network 
Protocol Address Of Target 
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